WORLD WIDE WEB AND HTTP

•The idea of the Web was first proposed by

Tim Berners-Lee in 1989 at CERN, the
European Organization for Nuclear Research,
to allow several researchers at different
locations throughout Europe to access each
others’ researches. The commercial Web
started in the early 1990s.
•WWW today is a distributed client-server
service, in which a client using a
browser can access a service using a server.
 Web Client (Browser)
•A variety of vendors offer commercial browsers that interpret and
display a web page, and all of them use nearly the same architecture.
• Each browser usually consists of 3 parts: a controller, client
protocols, and interpreters.
• controller receives input from the keyboard or the mouse and uses
client programs to access the document.
• After the document has been accessed, the controller uses one of
the interpreters to display the document on the screen. client
protocol-HTTP /FTP. Etc
• interpreter can be HTML/Java/JavaScript, depending on the type of
document.
 Web Server
The web page is stored at the server. Each time a request arrives, the
corresponding document is sent to the client.
Uniform Resource Locator (URL)
A web page, as a file, needs to have a unique identifier to distinguish
it from other web pages. To define a web page, we need three
identifiers: host, port, and path four identifiers to define the web
page
Protocol - client-server program that we need in order to access the
web [Link] HTTP (HyperText Transfer Protocol), others FTP
Host. host identifier can be the IP address of the server or the unique
name given to the server.
Port. a 16-bit integer, normally predefined for the client-server
[Link]: HTTP is used for accessing the web page port is 80.
Path. It identifies the location and the name of the file in the
underlying operating system. For eg /top/next/last/myfile is a path
that uniquely defines a file named myfile
 URL
protocol://host/path most of the time
protocol://host:port/path when port number is needed
Web Documents
Documents in WWW can be grouped into 3 broad categories:
static, dynamic & active
• Static documents are fixed-content documents that are created
and stored in a server.
• Client can get a copy of the document only.
• Contents of the file are determined when the file is created, not
when it is used.
• Of course, contents in the server can be changed, but the user
cannot change them., a copy of the document is sent.
•Static documents are prepared using one of several languages:
HyperText Markup Language (HTML), Extensible Markup Language
(XML), Extensible StyleLanguage (XSL), and Extensible Hypertext
Markup Language (XHTML).
• A dynamic document is created by a web server
whenever a browser requests the document.
• When a request arrives, the web server runs an
application program or a script that creates the
dynamic document.
• Server returns the result of the program or script as
a response to the browser that requested the
document.
• Because a fresh document is created for each
request, the contents of a dynamic document may
vary from one request to another. Eg: Time and
date
• Java Server Pages (JSP), Active Server Pages (ASP),
ColdFusion
Active Documents
• For many applications, we need a program or a
script to be run at the client site.
• These are called active documents
• For example, suppose we want to run a
program that creates animated graphics on the
screen or a program that interacts with the use.
•When a browser requests an active document,
the server sends a copy of the document or a
script. The document is then run at the client
(browser) site.
•Java applets
HyperText Transfer Protocol (HTTP)
GET /somedir/[Link] HTTP/1.1 Host: [Link]
Connection: close
User-agent: Mozilla/5.0
Accept-language: fr
HTTP/1.1 200 OK
Connection: close
Date: Tue, 09 Aug 2011 15:44:04 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Tue, 09 Aug 2011 15:11:03 GMT
Content-Length: 6821
Content-Type: text/html
(data data data data data ...)
 Some common status codes and associated phrases

•200 OK: Request succeeded and the information is returned in the

response.

• 301 Moved Permanently: Requested object has been permanently

moved; new URL is specified in Location: header of the response
message. Client software will automatically retrieve the new URL.

• 400 Bad Request: This is a generic error code indicating that the
request could not be understood by the server.

• 404 Not Found: The requested document does not exist on this
server.

• 505 HTTP Version Not Supported: The requested HTTP protocol

version is not supported by the server.
 Creating and Storing Cookies

1. When a server receives a request from a client, it

stores information about the client in a file or a string.

[Link] info may include the domain name of the client, a

timestamp & the contents of the cookie (info the
server has gathered about the client such as name,
registration number, etc).

3. Server includes the cookie in the response that it

sends to the client.

[Link] the client receives the response, the browser

stores the cookie in the cookie directory
 Four Uses of Cookies

❑ An electronic store (e-commerce) can use a cookie for its client

shoppers. When a client selects an item and inserts it in a cart, a cookie
that contains info about the item ( quantity ,unit price etc) is sent to the
browser. When the client finishes shopping and wants to check out, the
last cookie is retrieved and the total charge is calculated.

❑ The site that restricts access to registered clients only sends a cookie
when the client registers for the first time. For any repeated access, only
those clients that send the appropriate cookie are allowed.

❑ In a web When a user selects her favorite pages, a cookie is made

and sent. If the site is accessed again, the cookie is sent to the server to
show what the client is looking for.

❑ A cookie is also used by advertising agencies. An advertising agency

can place banner ads on some main website that is often visited by
users.
 Web cache( proxy server)
• A Web cache (proxy server)—is a network entity that satisfies HTTP requests
on the behalf of an origin Web server.
• The Web cache has its own disk storage and keeps copies of recently
requested objects in this storage.

• Say, a browser is requesting the object [Link] [Link]

 browser establishes a TCP connection to the Web cache and sends HTTP
request.
 Web cache checks to see if it has a copy of the object stored locally. If it
does, the Web cache returns the object within an HTTP response message
to the client browser.
 If it does not have the object, it opens a TCP connection to the origin
server, that is, to [Link], sends an HTTP request .
 When the Web cache receives the object, it stores a copy in its local
storage and sends a copy, within an HTTP response message, to the client
browser.
 Proxy Server Location
The proxy servers are normally located at the client site.
1.A client computer can also be used as a proxy server, in a small capacity,
that stores responses to requests often invoked by the client.
[Link] a company, a proxy server may be installed on the computer LAN to
reduce the load going out of and coming into the LAN.
[Link] ISP with many customers can install a proxy server to reduce the load
going out of and coming into the ISP network.
 The Conditional GET
• the copy of an object residing in the cache may be stale
• HTTP has a mechanism that allows a cache to verify that its objects are up to
date- conditional GET.
• request message includes an If-ModifiedSince: header line along with GET
• On the behalf of a requesting browser, a proxy cache sends a request message
to a Web server:
GET /fruit/[Link] HTTP/1.1
Host: [Link]
• Web server sends a response message with the requested object to the cache:
HTTP/1.1 200 OK
Date: Sat, 8 Oct 2011 15:39:29
Server: Apache/1.3.0 (Unix)
Last-Modified: Wed, 7 Sep 2011 09:23:24 Content-Type:
image/gif
data data data data data ...)
• cache forwards the object to the requesting browser but also caches the object
locally. It also stores the last-modified date along with the object.
• one week later, another browser requests the same object via the
cache, and the object is still in the cache.

GET /fruit/[Link] HTTP/1.1 Host: [Link]

If-modified-since: Wed, 7 Sep 2011 09:23:24

• Suppose the object has not been modified since 7 Sep 2011
09:23:24

HTTP/1.1 304 Not Modified

Date: Sat, 15 Oct 2011 15:39:29
Server: Apache/1.3.0 (Unix) (empty entity body)

• If modified, it includes the latest copy of object in respond msg,

which cache will store
 File Transfer Protocol (FTP)
File Transfer Protocol (FTP) is the standard protocol provided by TCP/IP for copying a
file from one host to another.
Although transferring files from one system to another seems simple and straight
forward, some problems must be dealt with first. For example, two systems may use
different file name conventions. Two systems may have different ways to represent
data. Two systems may have different directory structures.
For control communication, FTP uses ASCII character set uppercase
Some responses in FTP
 Data Connection
• The heterogeneity problem is resolved by defining three
attributes of communication: file type, data structure, and
transmission mode.
• File Type : ASCII file, EBCDIC file, or image file.
• Data Structure: file structure, record structure, or page
structure.
• In file structure format (used by default) has no
structure. It is a continuous stream of bytes.
• In the record structure, the file is divided into records.
This can be used only with text files.
• In the page structure, the file is divided into pages, with
each page having a page number and a page header.
• The pages can be stored and accessed randomly or
sequentially.
Transmission Mode : FTP can transfer a file across the
data connection using one of the following three
transmission modes: stream mode, block mode, or
compressed mode.
•The stream mode is the default mode; data are
delivered from FTP to TCP as a continuous stream of
bytes.
•In the block mode, data can be delivered from FTP to
TCP in blocks. In this case, each block is preceded by a
3-byte header. The first byte is called the block
descriptor; the next two bytes define the size of the
block in bytes.
•Large files are compressed before transfer to save
bandwidth and speed up transmission.
 Active and Passive
FTP
• Active
• How it works: The client connects to the server's port 21 for control.
• The client then sends a PORT command to tell the server a specific client-side
port to connect back to for data transfer.
• The server, using port 20, initiates the data connection back to the client's
specified port.
• security challenges because the client has to open ports for incoming
connections. may cause problems because of firewalls

• Passive
• common mode
• How it works: The client connects to the server's port 21 for control.
• The client then sends a PASV command, asking the server to open a random
port for data transfer.
• The server responds with a port number on its end, and the client initiates
the data connection to that port on the server.
 FTP SUMMARY
• 7-bit ASCII format
• readable by people
• to delineate successive commands, a carriage return and line feed
end each command
• Each command consists of four uppercase ASCII characters
• USER username: to send the user identification to the server.
• PASS password: to send the user password to the server.
• LIST: Used to ask the server to send back a list of all the files in the
current remote directory. The list of files is sent over a (new and non-
persistent) data connection rather than the control TCP connection.
• RETR filename: to retrieve a file from the current directory of the
remote host
• STOR filename: to store (that is, put) a file into the current directory
of the remote host
• 331 - Username OK, password required
• 125 - Data connection already open; transfer starting
• 425 - Can’t open data connection
• 452 - Error writing file
 ELECTRONIC MAIL

The e-mail system needs two UAs, two pairs of MTAs (client and server),
and a pair of MAAs (client and server).
Simple Mail Transfer Protocol (SMTP)
SMTP defines 14 commands
• Mail access starts with the client when the user needs to download its e-mail
from the mailbox on the mail server.
• The client opens a connection to the server on TCP port 110.
• It then sends its user name and password to access the mailbox.
• The user can then list and retrieve the mail messages, one by one.
• POP3 has two modes: the delete mode and the keep mode. In the delete mode,
the mail is deleted from the mailbox after each retrieval. In the keep mode, the
mail remains in the mailbox after retrieval
 IMAP4
IMAP4 provides the following extra functions- A user can:

❑ check the e-mail header prior to downloading.

❑ search the contents of the e-mail for a specific string of

characters prior to downloading.

❑ partially download e-mail. This is especially useful if

bandwidth is limited and the e-mail contains multimedia
with high bandwidth requirements.

❑ create, delete, or rename mailboxes on the mail server.

❑ create hierarchy of mailboxes in a folder for e-mail storage.

 PURPOSE OF DNS
Host name in URL to IP Address conversion
Internet needs to have a directory system that can map a name to an address
what happens when a browser ( an HTTP client) ,running on some user’s host,
requests URL [Link]/[Link]?

[Link] host machine runs the client

side of the DNS application.
[Link] extracts the hostname,
[Link], from the URL
and passes the hostname to the
client side of the DNS application.

[Link] client sends a query containing the hostname to a DNS server. receives a
reply, which includes the IP address for the hostname.
[Link] the browser receives the IP address from DNS, it can initiate a TCP
connection to the HTTP server process located at port 80 at that IP address.
 The generic domains define registered hosts according to their generic
behavior. Each node in the tree defines a domain, which is an index to the
domain name space database

Country Domains : The country domains section uses two-character country

abbreviations (e.g., us for United States ,in for India). Second labels can be
organizational, or they can be more specific national designations.
 Resource Records

• DNS distributed database store resource records (RRs)

• The zone information associated with a server is implemented as a set of
resource records
• RRs that provide hostname-to-IP address mappings.
• A resource record is a 5-tuple structure, as shown below:
• (Domain Name, Type, Class, TTL, Value)
• domain name field is what identifies the resource record.
• value defines the information kept about the domain name.
• TTL defines the number of seconds for which the information is valid. The
class defines the type of network; we are only interested in the class IN
(Internet).
• type defines how the value should be interpreted.
 • First 12 bytes -header
section.
• first field of header section is
a 16-bit
number that identifies the
query.
• This identifier is copied into
the reply message to a
query, allowing the client to
match received replies with
sent queries.

• flags field. (It also includes status of error.)

• A 1-bit query/reply flag- query (0) or a reply (1).
• A 1-bit authoritative flag is set in a reply message when a DNS server is an
authoritative server for a queried name.
• A1-bit recursion-desired flag
• A 1-bit recursion available field is set in a reply if the DNS server supports
recursion
 nslookup

In UNIX and Windows, the nslookup utility can be used to

retrieve address/name mapping. The following shows how
we can retrieve an address when the domain name is given.

$nslookup [Link] Name:

[Link] Address: [Link]
 Encapsulation
• port 53
• Mostly UDP Though DNS can use either UDP or TCP
• UDP is used when the size of the response message is less than
512 bytes because most UDP packages have a 512-byte packet
size limit. If the size of the response message is more than 512
bytes, a TCP connection is used.
How are new domains added to DNS?
• through a registrar, a commercial entity accredited by ICANN.
•A registrar first verifies that the requested domain name is
unique and then enters it into the DNS database.
• A fee is charged. Today, there are many registrars; their
names and addresses can be found at Registrars
[Link]
•To register, the organization needs to give the name of its
server and the IP address of the server.
 Security of DNS
• attacker may read the response of a DNS server to find the nature or
names of sites the user mostly accesses. This type of information can
be used to find the user’s profile. To prevent this attack, DNS
messages need to be confidential .

• attacker may intercept the response of a DNS server and change it or

create a totally new bogus response to direct the user to the site or
domain the attacker wishes the user to access. This type of attack
can be prevented using message origin authentication and message
integrity

• attacker may flood the DNS server to overwhelm it or eventually

crash it. This type of attack can be prevented using the provision
against denial-of-service DoS attack.
• IETF has devised a technology named DNS Security (DNSSEC) that
provides message origin authentication and message integrity using
a security service called digital signature
 TELNE
T
• One of the original remote logging protocols is TELNET,
which is an abbreviation for TErminaL NETwork.

• Although TELNET requires a logging name and

password, it is vulnerable to hacking because it sends
all data including the password in plaintext (not
encrypted).

• A hacker can eavesdrop and obtain the logging name

and password. Because of this security issue, the use of
TELNET has diminished in favor of another protocol,
Secure Shell (SSH)
Local V/S Remote logging
 Network Virtual Terminal (NVT) characters

• user keystrokes to the terminal driver- local OS accepts the

characters but does not interpret them.
• The characters are sent to the TELNET client, which
transforms the characters into a universal character set called
Network Virtual Terminal (NVT) characters and delivers them
to the local TCP/IP stack.
 Why (NVT) characters?

• We are dealing with heterogeneous systems.

• The mechanism to access a remote computer is
complex.
• This is because every computer and its operating
system accepts a special combination of
characters as tokens.
• For example, the end-of-file token in a computer
running the DOS operating system is Ctrl+z, while
the UNIX operating system recognizes Ctrl+d
• TELNET solves this problem by defining a universal interface called
the Network Virtual Terminal (NVT) character set.

• Via this interface, the client TELNET translates characters (data or

commands) that come from the local terminal into NVT form and
delivers them to the network.

• The server TELNET, on the other hand, translates data and

commands from NVT form into the form acceptable by the remote
computer.

• NVT uses two sets of characters, one for data and one for control.
Both are 8-bit bytes

• NVT ASCII. This is an 8-bit character set in which the seven lowest
order bits are almost same as US ASCII and the highest order bit is
0 for data and 1 for control
 USER INTERFACE

The operating system (UNIX, for example) defines an

interface with user-friendly commands
SECURE SHELL (SSH)

There are two versions of SSH: SSH-1 and SSH-2, which are totally
incompatible. SSH-1, is now deprecated because of security flaws in it. so we
discuss only SSH-2.
SSH is an application-layer protocol with three components

SSH Transport-Layer Protocol

(SSH-TRANS)
SSH Authentication Protocol
(SSH-AUTH)
SSH Connection Protocol (SSH-
CONN)
 SSH-TRANS.
• Since TCP is not a secured transport-layer protocol, SSH first
uses a protocol that creates a secured channel on top of the
TCP.
• This new layer is an independent protocol referred to as SSH-
TRANS.
• When this procedure is called, the client and server first use
the TCP protocol to establish an insecure connection.
• Then they exchange several security parameters to establish a
secure channel on top of the TCP.
[Link] or confidentiality of the message exchanged
2. Data integrity, which means that it is guaranteed that the
messages exchanged between the client and server are not
changed by an intruder
[Link] authentication, which means that the client is now
sure that the server is the one that it claims to be
4. Compression of the messages, which improves the
 SSH Authentication Protocol (SSH-AUTH)

• After a secure channel is established between the client and the

server and the server is authenticated for the client, SSH can call
another procedure that can authenticate the client for the
server.

• Authentication starts with the client, which sends a request

message to the server.

• The request includes the user name, server name, the method
of authentication, and the required data.

• The server responds with either a success message, which

confirms that the client is authenticated, or a failed message,
which means that the process needs to be repeated with a new
request message.
 SSH Connection Protocol (SSH-CONN)

• After the secured channel is established and both server and

client are authenticated for each other, SSH can call a piece of
software that implements the third protocol, SSHCONN.

• One of the services provided by the SSH-CONN protocol is

multiplexing.

• SSH-CONN takes the secure channel established by the two

previous protocols and lets the client create multiple logical
channels over it.

• Each channel can be used for a different purpose, such as remote

logging, file transfer, and so on.
 Applications
SSH is a general-purpose protocol that provides a secure
connection between a client and server.
a) SSH for Remote Logging:
•Several free and commercial applications use SSH for remote
logging.
•PuTTy, by Simon Tatham, which is a client SSH program that can
be used for remote logging.
•Tectia, used on several platforms
b) SSH for File Transfer:
•Secure File Transfer Program (sftp) built on top of SSH for file
[Link] uses one of the channels provided by the SSH to transfer
files.
•Secure Copy (scp). This application uses the same format as the
UNIX copy command, cp, to copy files.
 c) SSH Port Forwarding
• This mechanism creates a tunnel through which the
messages belonging to other protocols can travel.
• this mechanism is sometimes referred to as SSH tunneling.
• We can use the secured channels available in SSH to access
an application program that does not provide security
services. Applications like TELNET, SMTP,FTP can use it
 Format of the SSH Packets

• length field defines the length of the packet but does not include the
padding.
• One to eight bytes of padding is added to the packet to make the attack
on the security provision** more difficult.
• CRC field is used for error detection.
• type field designates the type of the packet used in different SSH
protocols.
• data field is the data transferred by the packet in different protocols.

**Block Cipher
• AES,3DES use fixed size blocks for encryption .Therefore padding
ensures (Packet length+1-8)% block size=[Link] Traffic analysis
Resistance
AES
DES